Password-Protected Zip Files in Unexpected Emails
An email with a zip file and a password in the message is a classic malware trick. Why attackers encrypt attachments, and what to do when you receive one.
"Please find the documents attached. Password: 2026." A zip file with a password written in the same email looks secure and official. In reality, it is a well-known trick for getting malware past email filters, which cannot scan inside encrypted archives.
Why attackers use it
- Filters are blind to encrypted content.
- It looks professional, as if the sender cares about security.
- The password is handed to you, so opening it is easy.
What is usually inside
- Programs disguised as documents. See dangerous attachments.
- Shortcut or script files that download malware.
- Documents asking you to enable macros. See the macro warning.
What to do
- Do not open archives you were not expecting.
- If it seems to be from someone you know, confirm with them by phone or chat.
- Report it with your report button or email provider.
- If you opened it, disconnect and tell IT. See opening an attachment by mistake.
Genuine secure sharing usually sends passwords separately, or uses a secure portal you can reach yourself.
Received a protected file you did not expect? Paste the email into CyberWatch AI Scan for a free check.
For more, see how phishing works in our complete guide.
Frequently asked questions
Why would an attacker password-protect a zip?
Because security filters cannot look inside encrypted archives, so the malware inside is less likely to be caught before it reaches you.
Do genuine businesses send password-protected files?
Some do for sensitive documents, but they usually send the password through a separate channel, and you are expecting the file.
What should I do with one?
If you were not expecting it, do not open it. Confirm with the sender through another channel, or report it.
Sources
- Suspicious email actions, UK National Cyber Security Centre
- Malware: How To Protect Against, Detect, and Remove It, US Federal Trade Commission
- Mitigating malware and ransomware attacks, UK National Cyber Security Centre
